PT-2022-26908 · Jenkins · Jenkins Compuware Xpediter Code Coverage Plugin+1

Published 2022-10-19 · Updated 2025-05-08 · CVE-2022-43424

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Compuware Xpediter Code Coverage Plugin versions 1.0.7 and earlier Jenkins versions 2.318 and earlier, LTS 2.303.2 and earlier

Description The issue allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process. This is due to an agent/controller message that does not limit where it can be executed.

Recommendations For Jenkins Compuware Xpediter Code Coverage Plugin versions 1.0.7 and earlier, update to version 1.0.8 or later, which restricts execution of the agent/controller message to agents. For Jenkins versions 2.318 and earlier, LTS 2.303.2 and earlier, upgrade to a newer version, following the LTS upgrade guide.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2022-43424

GHSA-MFCW-83QG-4VW3

Affected Products

Jenkins

Jenkins Compuware Xpediter Code Coverage Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-mfcw-83qg-4vw3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43424 · Security Note
• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2627 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43424 · Vendor Advisory
• https://github.com/jenkinsci/compuware-xpediter-code-coverage-plugin/commit/e506fc9e77a2609f6a5aa331e052d35be652071c · Note
• https://github.com/jenkinsci/compuware-xpediter-code-coverage-plugin · Note
• https://t.me/cvenotify/121471 · Telegram Post
• https://t.me/cibsecurity/51812 · Telegram Post
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note